Is @mcp-i/core safe to use?

@mcp-i/core has a security risk score of 100/100 (CRITICAL risk). Our security analysis detected 573 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of @mcp-i/core?

Based on our automated security analysis, @mcp-i/core presents critical risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Is "@mcp-i/core" on MCP Registry Safe to Install?

Name: @mcp-i/core
Availability: InStock
Author: bestbrian

bestbrian · mcp · v1.1.3

Core library for MCP-I — delegation, proof, and session primitives for Model Context Protocol Identity

Risk Assessment

Analyzed

100

out of 100

CRITICAL

573 security findings detected across all analyzers

MCP server analyzed for tool poisoning, prompt injection, and data exfiltration

Severity Breakdown

Critical

247

High

244

Medium

Low

Info

Finding Categories

246

Malware Signatures

Secrets

Network

211

IoC Indicators

YARA Rules Matched

9 rules(246 hits)

postinstall obfuscation postinstall network communication postinstall crypto operations postinstall file manipulation postinstall file download postinstall system command postinstall environment access postinstall registry modification NoUseWeakRandom

MCP Server Analysis

MCP servers expose tools and resources to AI assistants. Unlike browser extensions, they run as standalone processes with direct system access. Tool definitions are analyzed for prompt injection, data exfiltration, and tool poisoning patterns.

About This Extension

Core library for MCP-I — delegation, proof, and session primitives for Model Context Protocol Identity

Detailed Findings

346 total

YARA Rule Matches

9 rules

Indicators of Compromise

Network indicators, suspicious strings, and potential IoCs extracted during analysis

URLs

Domains

141

Strings

211

All Indicators · 211

Domain

detected Domain: err.name

XIOC detected Domain: err.name

extracted_from_files

Domain

detected Domain: this.name

XIOC detected Domain: this.name

extracted_from_files

URL

detected URL: http://internal-service.local/api',

XIOC detected URL: http://internal-service.local/api',

extracted_from_files

URL

detected URL: https://secure.example.org/endpoint',

XIOC detected URL: https://secure.example.org/endpoint',

extracted_from_files

Domain

detected Domain: contributing.md

XIOC detected Domain: contributing.md

extracted_from_files

Domain

detected Domain: conformance.md

XIOC detected Domain: conformance.md

extracted_from_files

Domain

detected Domain: date.now

XIOC detected Domain: date.now

extracted_from_files

Domain

detected Domain: readme.md

XIOC detected Domain: readme.md

extracted_from_files

Domain

detected Domain: modelcontextprotocol-identity.io

XIOC detected Domain: modelcontextprotocol-identity.io

extracted_from_files

Domain

detected Domain: www.npmjs.com

XIOC detected Domain: www.npmjs.com

extracted_from_files

Domain

detected Domain: github.com

XIOC detected Domain: github.com

extracted_from_files

Domain

detected Domain: index.js.map

XIOC detected Domain: index.js.map

extracted_from_files

Domain

detected Domain: index.d.ts.map

XIOC detected Domain: index.d.ts.map

extracted_from_files

Domain

detected Domain: handshake.js.map

XIOC detected Domain: handshake.js.map

extracted_from_files

Domain

detected Domain: api.qrserver.com

XIOC detected Domain: api.qrserver.com

extracted_from_files

Domain

detected Domain: handshake.d.ts.map

XIOC detected Domain: handshake.d.ts.map

extracted_from_files

Domain

detected Domain: security.md

XIOC detected Domain: security.md

extracted_from_files

Domain

detected Domain: governance.md

XIOC detected Domain: governance.md

extracted_from_files

Domain

detected Domain: cascading-revocation.d.ts.map

XIOC detected Domain: cascading-revocation.d.ts.map

extracted_from_files

Domain

detected Domain: bitstring.js.map

XIOC detected Domain: bitstring.js.map

extracted_from_files

Domain

detected Domain: bitstring.d.ts.map

XIOC detected Domain: bitstring.d.ts.map

extracted_from_files

Domain

detected Domain: audience-validator.js.map

XIOC detected Domain: audience-validator.js.map

extracted_from_files

Domain

detected Domain: audience-validator.d.ts.map

XIOC detected Domain: audience-validator.d.ts.map

extracted_from_files

Domain

detected Domain: types.js.map

XIOC detected Domain: types.js.map

extracted_from_files

Domain

detected Domain: types.d.ts.map

XIOC detected Domain: types.d.ts.map

extracted_from_files

Domain

detected Domain: identity.foundation

XIOC detected Domain: identity.foundation

extracted_from_files

Hash

detected MD5 Hash: 302e020100300506032b657004220420

XIOC detected MD5 Hash: 302e020100300506032b657004220420

extracted_from_files

Hash

detected SHA256 Hash: 0000000000000000000000000000000000000000000000000000000000000000

XIOC detected SHA256 Hash: 0000000000000000000000000000000000000000000000000000000000000000

extracted_from_files

URL

detected URL: https://example.com/status/suspension/v1

XIOC detected URL: https://example.com/status/suspension/v1

extracted_from_files

URL

detected URL: https://example.com/status/new

XIOC detected URL: https://example.com/status/new

extracted_from_files

URL

detected URL: https://example.com/status/revocation/v1

XIOC detected URL: https://example.com/status/revocation/v1

extracted_from_files

URL

detected URL: https://status.example.com/revocation/v1#0',

XIOC detected URL: https://status.example.com/revocation/v1#0',

extracted_from_files

URL

detected URL: https://status.example.com/revocation/v1',

XIOC detected URL: https://status.example.com/revocation/v1',

extracted_from_files

URL

detected URL: https://schema.modelcontextprotocol-identity.io/xmcp-i/credentials/delegation.v1.0.0.json'

XIOC detected URL: https://schema.modelcontextprotocol-identity.io/xmcp-i/credentials/delegation.v1.0.0.json'

extracted_from_files

URL

detected URL: https://example.com/status/revocation/v1#list

XIOC detected URL: https://example.com/status/revocation/v1#list

extracted_from_files

URL

detected URL: https://example.com/status/suspension/v1#list

XIOC detected URL: https://example.com/status/suspension/v1#list

extracted_from_files

URL

detected URL: https://factory.example.com/status

XIOC detected URL: https://factory.example.com/status

extracted_from_files

URL

detected URL: https://example.com/context

XIOC detected URL: https://example.com/context

extracted_from_files

URL

detected URL: https://example.com/status

XIOC detected URL: https://example.com/status

extracted_from_files

URL

detected URL: https://example.com/status#$

XIOC detected URL: https://example.com/status#$

extracted_from_files

URL

detected URL: https://status.example.com/revocation/v1#42

XIOC detected URL: https://status.example.com/revocation/v1#42

extracted_from_files

URL

detected URL: https://status.example.com/revocation/v1

XIOC detected URL: https://status.example.com/revocation/v1

extracted_from_files

URL

detected URL: https://status.example.com/suspension/v1#100

XIOC detected URL: https://status.example.com/suspension/v1#100

extracted_from_files

URL

detected URL: https://status.example.com/suspension/v1

XIOC detected URL: https://status.example.com/suspension/v1

extracted_from_files

URL

detected URL: https://status.example.com/revocation/v1#5

XIOC detected URL: https://status.example.com/revocation/v1#5

extracted_from_files

Domain

detected Domain: delegation-graph.d.ts.map

XIOC detected Domain: delegation-graph.d.ts.map

extracted_from_files

Domain

detected Domain: events.map

XIOC detected Domain: events.map

extracted_from_files

URL

detected URL: https://w3id.org/vc/status-list/2021/v1

XIOC detected URL: https://w3id.org/vc/status-list/2021/v1

extracted_from_files

URL

detected URL: https://status.example.com

XIOC detected URL: https://status.example.com

extracted_from_files

URL

detected URL: https://custom.example.com/status

XIOC detected URL: https://custom.example.com/status

extracted_from_files

URL

detected URL: https://example.com/user/did.json');

XIOC detected URL: https://example.com/user/did.json');

extracted_from_files

URL

detected URL: https://example.com/path/to/doc/did.json');

XIOC detected URL: https://example.com/path/to/doc/did.json');

extracted_from_files

URL

detected URL: https://example.com/agents/bot1/did.json');

XIOC detected URL: https://example.com/agents/bot1/did.json');

extracted_from_files

URL

detected URL: https://example.com:8080/.well-known/did.json');

XIOC detected URL: https://example.com:8080/.well-known/did.json');

extracted_from_files

URL

detected URL: https://example.com:3000/users/alice/did.json');

XIOC detected URL: https://example.com:3000/users/alice/did.json');

extracted_from_files

URL

detected URL: https://example.com/.well-known/did.json'

XIOC detected URL: https://example.com/.well-known/did.json'

extracted_from_files

URL

detected URL: https://example.com/agents/bot1/did.json'

XIOC detected URL: https://example.com/agents/bot1/did.json'

extracted_from_files

URL

detected URL: https://example.com/status#1

XIOC detected URL: https://example.com/status#1

extracted_from_files

URL

detected URL: https://example.com/status#0

XIOC detected URL: https://example.com/status#0

extracted_from_files

URL

detected URL: https://example.com/status#2

XIOC detected URL: https://example.com/status#2

extracted_from_files

URL

detected URL: https://example.com/status#123

XIOC detected URL: https://example.com/status#123

extracted_from_files

URL

detected URL: https://example.com/.well-known/did.json');

XIOC detected URL: https://example.com/.well-known/did.json');

extracted_from_files

URL

detected URL: https://agents.example.com/.well-known/did.json');

XIOC detected URL: https://agents.example.com/.well-known/did.json');

extracted_from_files

URL

detected URL: https://example.com/status#root

XIOC detected URL: https://example.com/status#root

extracted_from_files

URL

detected URL: https://example.com/status#child1

XIOC detected URL: https://example.com/status#child1

extracted_from_files

URL

detected URL: https://example.com/status#child2

XIOC detected URL: https://example.com/status#child2

extracted_from_files

URL

detected URL: https://example.com/status#grandchild

XIOC detected URL: https://example.com/status#grandchild

extracted_from_files

URL

detected URL: https://example.com/status#child

XIOC detected URL: https://example.com/status#child

extracted_from_files

URL

detected URL: https://w3c-ccg.github.io/did-key-spec/#document-creation-algorithm

XIOC detected URL: https://w3c-ccg.github.io/did-key-spec/#document-creation-algorithm

extracted_from_files

URL

detected URL: https://github.com/modelcontextprotocol-identity/mcp-i-core

XIOC detected URL: https://github.com/modelcontextprotocol-identity/mcp-i-core

extracted_from_files

URL

detected URL: https://example.com/consent');

XIOC detected URL: https://example.com/consent');

extracted_from_files

URL

detected URL: https://example.com/consent?scope=greeting:restricted',

XIOC detected URL: https://example.com/consent?scope=greeting:restricted',

extracted_from_files

Domain

detected Domain: child.id

XIOC detected Domain: child.id

extracted_from_files

URL

detected URL: https://reputation.example.com',

XIOC detected URL: https://reputation.example.com',

extracted_from_files

Domain

detected Domain: params.id

XIOC detected Domain: params.id

extracted_from_files

URL

detected URL: https://example.com/path/to/doc/did.json

XIOC detected URL: https://example.com/path/to/doc/did.json

extracted_from_files

URL

detected URL: https://downstream-api.example.com/resource',

XIOC detected URL: https://downstream-api.example.com/resource',

extracted_from_files

URL

detected URL: https://status.example.com';

XIOC detected URL: https://status.example.com';

extracted_from_files

URL

detected URL: https://w3id.org/vc/status-list/2021/v1',

XIOC detected URL: https://w3id.org/vc/status-list/2021/v1',

extracted_from_files

URL

detected URL: https://modelcontextprotocol-identity.io

XIOC detected URL: https://modelcontextprotocol-identity.io

extracted_from_files

URL

detected URL: https://schema.modelcontextprotocol-identity.io/xmcp-i/credentials/delegation.v1.0.0.json

XIOC detected URL: https://schema.modelcontextprotocol-identity.io/xmcp-i/credentials/delegation.v1.0.0.json

extracted_from_files

URL

detected URL: https://schema.modelcontextprotocol-identity.io/xmcp-i/credentials/delegation.v1.0.0.json';

XIOC detected URL: https://schema.modelcontextprotocol-identity.io/xmcp-i/credentials/delegation.v1.0.0.json';

extracted_from_files

URL

detected URL: https://example.com/consent'

XIOC detected URL: https://example.com/consent'

extracted_from_files

URL

detected URL: https://www.npmjs.com/package/@kya-os/consent)

XIOC detected URL: https://www.npmjs.com/package/@kya-os/consent)

extracted_from_files

URL

detected URL: https://api.qrserver.com/v1/create-qr-code/?data=$

XIOC detected URL: https://api.qrserver.com/v1/create-qr-code/?data=$

extracted_from_files

URL

detected URL: https://w3c-ccg.github.io/did-method-key/

XIOC detected URL: https://w3c-ccg.github.io/did-method-key/

extracted_from_files

URL

detected URL: https://example.com/.well-known/did.json

XIOC detected URL: https://example.com/.well-known/did.json

extracted_from_files

URL

detected URL: https://example.com/agents/bot1/did.json

XIOC detected URL: https://example.com/agents/bot1/did.json

extracted_from_files

URL

detected URL: https://w3c-ccg.github.io/did-method-web/

XIOC detected URL: https://w3c-ccg.github.io/did-method-web/

extracted_from_files

Other

detected Email: [email protected]

XIOC detected Email: [email protected]

extracted_from_files

Other

detected Email: reference@${delegation.id

XIOC detected Email: reference@${delegation.id

extracted_from_files

Other

detected Email: ended@${finaldelegation.id

XIOC detected Email: ended@${finaldelegation.id

extracted_from_files

URL

detected URL: https://identity.foundation/working-groups/agent-and-authorization.html)

XIOC detected URL: https://identity.foundation/working-groups/agent-and-authorization.html)

extracted_from_files

URL

detected URL: https://modelcontextprotocol-identity.io)

XIOC detected URL: https://modelcontextprotocol-identity.io)

extracted_from_files

URL

detected URL: https://github.com/modelcontextprotocol-identity/mcp-i-core.git

XIOC detected URL: https://github.com/modelcontextprotocol-identity/mcp-i-core.git

extracted_from_files

URL

detected URL: https://github.com/modelcontextprotocol/inspector):

XIOC detected URL: https://github.com/modelcontextprotocol/inspector):

extracted_from_files

Domain

detected Domain: parentvc.credentialsubject.delegation.id

XIOC detected Domain: parentvc.credentialsubject.delegation.id

extracted_from_files

URL

detected URL: https://api.service.example.com:8443/v1/resource?query=test',

XIOC detected URL: https://api.service.example.com:8443/v1/resource?query=test',

extracted_from_files

Domain

detected Domain: mockclockprovider.now

XIOC detected Domain: mockclockprovider.now

extracted_from_files

Domain

detected Domain: test.com

XIOC detected Domain: test.com

extracted_from_files

Domain

detected Domain: server.com

XIOC detected Domain: server.com

extracted_from_files

Domain

detected Domain: old-server.com

XIOC detected Domain: old-server.com

extracted_from_files

Domain

detected Domain: new-server.com

XIOC detected Domain: new-server.com

extracted_from_files

Domain

detected Domain: d.id

XIOC detected Domain: d.id

extracted_from_files

Domain

detected Domain: other.com

XIOC detected Domain: other.com

extracted_from_files

Domain

detected Domain: testlogger.info

XIOC detected Domain: testlogger.info

extracted_from_files

Domain

detected Domain: logger.info

XIOC detected Domain: logger.info

extracted_from_files

Domain

detected Domain: mcpi.mcpitool.name

XIOC detected Domain: mcpi.mcpitool.name

extracted_from_files

Domain

detected Domain: mcpi.mcpitool.inputschema.properties

XIOC detected Domain: mcpi.mcpitool.inputschema.properties

extracted_from_files

Domain

detected Domain: mcpi.handshaketool.name

XIOC detected Domain: mcpi.handshaketool.name

extracted_from_files

Domain

detected Domain: server3.com

XIOC detected Domain: server3.com

extracted_from_files

Domain

detected Domain: server2.com

XIOC detected Domain: server2.com

extracted_from_files

Domain

detected Domain: this.storage

XIOC detected Domain: this.storage

extracted_from_files

Domain

detected Domain: status.id

XIOC detected Domain: status.id

extracted_from_files

Domain

detected Domain: children.map

XIOC detected Domain: children.map

extracted_from_files

Domain

detected Domain: c.id

XIOC detected Domain: c.id

extracted_from_files

Domain

detected Domain: descendants.map

XIOC detected Domain: descendants.map

extracted_from_files

Domain

detected Domain: ed25519-constants.js.map

XIOC detected Domain: ed25519-constants.js.map

extracted_from_files

Domain

detected Domain: result.tools.map

XIOC detected Domain: result.tools.map

extracted_from_files

Domain

detected Domain: t.name

XIOC detected Domain: t.name

extracted_from_files

Domain

detected Domain: instance.now

XIOC detected Domain: instance.now

extracted_from_files

Domain

detected Domain: user.com

XIOC detected Domain: user.com

extracted_from_files

Domain

detected Domain: other-server.com

XIOC detected Domain: other-server.com

extracted_from_files

Domain

detected Domain: server1.com

XIOC detected Domain: server1.com

extracted_from_files

Domain

detected Domain: base64.d.ts.map

XIOC detected Domain: base64.d.ts.map

extracted_from_files

Domain

detected Domain: base64.js.map

XIOC detected Domain: base64.js.map

extracted_from_files

Domain

detected Domain: crypto-service.d.ts.map

XIOC detected Domain: crypto-service.d.ts.map

extracted_from_files

Domain

detected Domain: crypto-service.js.map

XIOC detected Domain: crypto-service.js.map

extracted_from_files

Domain

detected Domain: did-helpers.d.ts.map

XIOC detected Domain: did-helpers.d.ts.map

extracted_from_files

Domain

detected Domain: did-helpers.js.map

XIOC detected Domain: did-helpers.js.map

extracted_from_files

Domain

detected Domain: ed25519-constants.d.ts.map

XIOC detected Domain: ed25519-constants.d.ts.map

extracted_from_files

Domain

detected Domain: manager.js.map

XIOC detected Domain: manager.js.map

extracted_from_files

Domain

detected Domain: schema.modelcontextprotocol-identity.io

XIOC detected Domain: schema.modelcontextprotocol-identity.io

extracted_from_files

Domain

detected Domain: protocol.d.ts.map

XIOC detected Domain: protocol.d.ts.map

extracted_from_files

Domain

detected Domain: credentialsubject.id

XIOC detected Domain: credentialsubject.id

extracted_from_files

Domain

detected Domain: protocol.js.map

XIOC detected Domain: protocol.js.map

extracted_from_files

Domain

detected Domain: base58.d.ts.map

XIOC detected Domain: base58.d.ts.map

extracted_from_files

Domain

detected Domain: base58.js.map

XIOC detected Domain: base58.js.map

extracted_from_files

Domain

detected Domain: base.js.map

XIOC detected Domain: base.js.map

extracted_from_files

Domain

detected Domain: memory.d.ts.map

XIOC detected Domain: memory.d.ts.map

extracted_from_files

Domain

detected Domain: memory.js.map

XIOC detected Domain: memory.js.map

extracted_from_files

Domain

detected Domain: node-crypto.d.ts.map

XIOC detected Domain: node-crypto.d.ts.map

extracted_from_files

Domain

detected Domain: node-crypto.js.map

XIOC detected Domain: node-crypto.js.map

extracted_from_files

Domain

detected Domain: manager.d.ts.map

XIOC detected Domain: manager.d.ts.map

extracted_from_files

Domain

detected Domain: this.config.noncecache.constructor.name

XIOC detected Domain: this.config.noncecache.constructor.name

extracted_from_files

Domain

detected Domain: verifier.d.ts.map

XIOC detected Domain: verifier.d.ts.map

extracted_from_files

Domain

detected Domain: validationresult.data

XIOC detected Domain: validationresult.data

extracted_from_files

Domain

detected Domain: this.clock.now

XIOC detected Domain: this.clock.now

extracted_from_files

Domain

detected Domain: doc.verificationmethod.map

XIOC detected Domain: doc.verificationmethod.map

extracted_from_files

Domain

detected Domain: verificationmethod.id

XIOC detected Domain: verificationmethod.id

extracted_from_files

Domain

detected Domain: verifier.js.map

XIOC detected Domain: verifier.js.map

extracted_from_files

Domain

detected Domain: base.d.ts.map

XIOC detected Domain: base.d.ts.map

extracted_from_files

Domain

detected Domain: previousdelegation.id

XIOC detected Domain: previousdelegation.id

extracted_from_files

Domain

detected Domain: cascading-revocation.js.map

XIOC detected Domain: cascading-revocation.js.map

extracted_from_files

Domain

detected Domain: delegation-revocation.md

XIOC detected Domain: delegation-revocation.md

extracted_from_files

Domain

detected Domain: generator.d.ts.map

XIOC detected Domain: generator.d.ts.map

extracted_from_files

Domain

detected Domain: response.data

XIOC detected Domain: response.data

extracted_from_files

Domain

detected Domain: generator.js.map

XIOC detected Domain: generator.js.map

extracted_from_files

Domain

detected Domain: request.params.name

XIOC detected Domain: request.params.name

extracted_from_files

Domain

detected Domain: with-mcpi.d.ts.map

XIOC detected Domain: with-mcpi.d.ts.map

extracted_from_files

Domain

detected Domain: childdelegation.id

XIOC detected Domain: childdelegation.id

extracted_from_files

Domain

detected Domain: parentcredential.credentialsubject.delegation.id

XIOC detected Domain: parentcredential.credentialsubject.delegation.id

extracted_from_files

Domain

detected Domain: spec.md

XIOC detected Domain: spec.md

extracted_from_files

Domain

detected Domain: leafdelegation.id

XIOC detected Domain: leafdelegation.id

extracted_from_files

Domain

detected Domain: credential.credentialsubject.delegation.id

XIOC detected Domain: credential.credentialsubject.delegation.id

extracted_from_files

Domain

detected Domain: logger.js.map

XIOC detected Domain: logger.js.map

extracted_from_files

Domain

detected Domain: mcpi-transport.d.ts.map

XIOC detected Domain: mcpi-transport.d.ts.map

extracted_from_files

Domain

detected Domain: message.id

XIOC detected Domain: message.id

extracted_from_files

Domain

detected Domain: mcpi-transport.js.map

XIOC detected Domain: mcpi-transport.js.map

extracted_from_files

Domain

detected Domain: with-mcpi-server.d.ts.map

XIOC detected Domain: with-mcpi-server.d.ts.map

extracted_from_files

Domain

detected Domain: result.content.map

XIOC detected Domain: result.content.map

extracted_from_files

Domain

detected Domain: with-mcpi-server.js.map

XIOC detected Domain: with-mcpi-server.js.map

extracted_from_files

Domain

detected Domain: vc.issuer.id

XIOC detected Domain: vc.issuer.id

extracted_from_files

Domain

detected Domain: vm.id

XIOC detected Domain: vm.id

extracted_from_files

Domain

detected Domain: vc-verifier.js.map

XIOC detected Domain: vc-verifier.js.map

extracted_from_files

Domain

detected Domain: errors.d.ts.map

XIOC detected Domain: errors.d.ts.map

extracted_from_files

Domain

detected Domain: errors.js.map

XIOC detected Domain: errors.js.map

extracted_from_files

Domain

detected Domain: logger.d.ts.map

XIOC detected Domain: logger.d.ts.map

extracted_from_files

Domain

detected Domain: console.info

XIOC detected Domain: console.info

extracted_from_files

Domain

detected Domain: utils.js.map

XIOC detected Domain: utils.js.map

extracted_from_files

Domain

detected Domain: delegation-service.md

XIOC detected Domain: delegation-service.md

extracted_from_files

Domain

detected Domain: vc-issuer.d.ts.map

XIOC detected Domain: vc-issuer.d.ts.map

extracted_from_files

Domain

detected Domain: options.id

XIOC detected Domain: options.id

extracted_from_files

Domain

detected Domain: vc-issuer.js.map

XIOC detected Domain: vc-issuer.js.map

extracted_from_files

Domain

detected Domain: vc-verifier.d.ts.map

XIOC detected Domain: vc-verifier.d.ts.map

extracted_from_files

Domain

detected Domain: vc.id

XIOC detected Domain: vc.id

extracted_from_files

Domain

detected Domain: w3id.org

XIOC detected Domain: w3id.org

extracted_from_files

Domain

detected Domain: statuslist-manager.js.map

XIOC detected Domain: statuslist-manager.js.map

extracted_from_files

Domain

detected Domain: memory-graph-storage.d.ts.map

XIOC detected Domain: memory-graph-storage.d.ts.map

extracted_from_files

Domain

detected Domain: memory-graph-storage.js.map

XIOC detected Domain: memory-graph-storage.js.map

extracted_from_files

Domain

detected Domain: memory-statuslist-storage.d.ts.map

XIOC detected Domain: memory-statuslist-storage.d.ts.map

extracted_from_files

Domain

detected Domain: memory-statuslist-storage.js.map

XIOC detected Domain: memory-statuslist-storage.js.map

extracted_from_files

Domain

detected Domain: utils.d.ts.map

XIOC detected Domain: utils.d.ts.map

extracted_from_files

Domain

detected Domain: did-web-resolver.js.map

XIOC detected Domain: did-web-resolver.js.map

extracted_from_files

Domain

detected Domain: outbound-headers.d.ts.map

XIOC detected Domain: outbound-headers.d.ts.map

extracted_from_files

Domain

detected Domain: delegation.id

XIOC detected Domain: delegation.id

extracted_from_files

Domain

detected Domain: outbound-headers.js.map

XIOC detected Domain: outbound-headers.js.map

extracted_from_files

Domain

detected Domain: outbound-proof.d.ts.map

XIOC detected Domain: outbound-proof.d.ts.map

extracted_from_files

Domain

detected Domain: outbound-proof.js.map

XIOC detected Domain: outbound-proof.js.map

extracted_from_files

Domain

detected Domain: statuslist-manager.d.ts.map

XIOC detected Domain: statuslist-manager.d.ts.map

extracted_from_files

Domain

detected Domain: parent.id

XIOC detected Domain: parent.id

extracted_from_files

Domain

detected Domain: delegation-graph.js.map

XIOC detected Domain: delegation-graph.js.map

extracted_from_files

Domain

detected Domain: w3c-ccg.github.io

XIOC detected Domain: w3c-ccg.github.io

extracted_from_files

Domain

detected Domain: did-key-resolver.d.ts.map

XIOC detected Domain: did-key-resolver.d.ts.map

extracted_from_files

Domain

detected Domain: did-key-resolver.js.map

XIOC detected Domain: did-key-resolver.js.map

extracted_from_files

Domain

detected Domain: did-web-resolver.d.ts.map

XIOC detected Domain: did-web-resolver.d.ts.map

extracted_from_files

Domain

detected Domain: json.id

XIOC detected Domain: json.id

extracted_from_files

Domain

detected Domain: node.id

XIOC detected Domain: node.id

extracted_from_files

Domain

detected Domain: finaldelegation.id

XIOC detected Domain: finaldelegation.id

extracted_from_files

Domain

detected Domain: with-mcpi.js.map

XIOC detected Domain: with-mcpi.js.map

extracted_from_files

URL

detected URL: https://example.com/consent',

XIOC detected URL: https://example.com/consent',

extracted_from_files

Security Analysis Summary

Security Analysis Overview

@mcp-i/core is a mcp extension published by bestbrian. Version 1.1.3 has been analyzed by the Risky Plugins security platform, receiving a risk score of 100/100 (CRITICAL risk) based on 573 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

High: 247 finding(s)
Medium: 244 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

Malware Detection: YARA rule matching against 2,400+ malware signatures
Secret Detection: Scanning for exposed API keys, tokens, and credentials
Static Analysis: Code-level security analysis for common vulnerability patterns
Network Analysis: Detection of suspicious network communications and endpoints
Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

@mcp-i/core is published by bestbrian on the mcp marketplace.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

@koneksi/mcp-server

alvinreyes

CRITICAL

update-browserslist-db

CRITICAL

@iflow-mcp/intuit-quickbooks-online-mcp-server

chatflowdev

CRITICAL

@youtyan/browser-pilot

GitHub Actions

CRITICAL

second-brain-health-check

iwo-szapar

CRITICAL

@nitrostack/core

abhishekpanditoff

CRITICAL

Risk Assessment

Severity Breakdown

Finding Categories

YARA Rules Matched

MCP Server Analysis

About This Extension

Detailed Findings

MCP-TOOL-CREDENTIAL-ACCESS-src/middleware/with-mcpi.ts-243

NET-FETCH-dist/auth/handshake.js-189

NET-FETCH-dist/delegation/outbound-headers.js-90

NET-FETCH-dist/delegation/outbound-headers.d.ts-75

NET-FETCH-src/delegation/outbound-headers.ts-130

NET-FETCH-src/providers/base.ts-35

NET-FETCH-src/auth/handshake.ts-373

NET-FETCH-src/auth/handshake.ts-382

NET-FETCH-src/middleware/with-mcpi.ts-234

NET-FETCH-src/__tests__/integration/mcp-transport.test.ts-58

NET-FETCH-dist/auth/handshake.js-196

NET-FETCH-dist/middleware/with-mcpi.js-41

NET-FETCH-src/__tests__/integration/full-flow.test.ts-63

NET-FETCH-src/middleware/with-mcpi.ts-239

NET-FETCH-dist/delegation/did-web-resolver.js-159

NET-FETCH-dist/middleware/with-mcpi.js-45

NET-FETCH-src/delegation/did-web-resolver.ts-200

NET-FETCH-dist/providers/base.d.ts-34

HASH-d4154b61dfdd4799

HASH-c563d3beb6eb76c5

HASH-f4385ce16893ef26

HASH-85b839ab5ea34103

HASH-e9ca90eef633ad9c

HASH-d6af2e8a3a9a339b

HASH-e01da409047e4df1

HASH-559bfb8e85c2ea29

HASH-9e308e365791ce30

HASH-9c226919c5658781

HASH-2e679802bd013f53

HASH-22b0921613707e2c

HASH-4d1a45c87f314c91

HASH-44e1af5e27489b71

HASH-0ad26210286b9828

HASH-5a2e11dfe6182a61

HASH-d367d428c8295c82

HASH-355da2d3ce7c36a5

HASH-40e296940af6438c

HASH-93db004fd325448f

HASH-81a9a3c7c17ee4e0

HASH-ed556b870e3aa079

HASH-011f39ef2603e904

HASH-c0e42e3d0e50bf57

HASH-787e8bd9952d6411

HASH-7dfb495477b612f0

HASH-9fee78042fa3deeb

HASH-a00eeed416138ba7

HASH-15ea522f5ea7c77d

HASH-00b7dbe531e72e16

HASH-1668436e761c916a

HASH-9cb2fd076b23dea4

HASH-82f4217f7fa9009d

HASH-076ba33a741ed593

HASH-d761aced6996b142

HASH-cd79879619b482e6

HASH-85ab157b801ccefb

HASH-b18d3901a724072b

HASH-8298fdfe5d2f84c8

HASH-21c7a935620f128d

HASH-e641a3bda4e7f0e9

HASH-4a811b3a733c1ca3

HASH-413f44814eae2012

HASH-b87cb731b54f2ca7

HASH-7df6e0d155bc983a

HASH-6cd0fdeb8f8484d8

HASH-12a16eaaa41aa14a

HASH-a9fcd5d8e80602c5

HASH-f8bb4c4a484d1cc5

HASH-a97e6c798df8764d

HASH-681a1adb8bfdf3e6

HASH-c60abc4c3f87b127

HASH-f72fcafb83383df6

HASH-ea136a4644350d59

HASH-47374f9dbd41061a

NET-FETCH-src/tests/integration/mcp-transport.test.ts-58

NET-FETCH-src/tests/integration/full-flow.test.ts-63